An infrastructure-based wireless network typically includes a communication network with fixed and wired gateways. Many infrastructure-based wireless networks employ a mobile unit or host which communicates with a fixed base station that is coupled to a wired network. The mobile unit can move geographically while it is communicating over a wireless link to the base station. When the mobile unit moves out of range of one base station, it may connect or “handover” to a new base station and starts communicating with the wired network through the new base station.
In comparison to infrastructure-based wireless networks, such as cellular networks or satellite networks, ad hoc networks are self-forming networks which can operate in the absence of any fixed infrastructure, and in some cases the ad hoc network is formed entirely of mobile nodes. An ad hoc network typically includes a number of geographically-distributed, potentially mobile units, sometimes referred to as “nodes,” which are wirelessly connected to each other by one or more links (e.g., radio frequency communication channels). The nodes can communicate with each other over a wireless media without the support of an infrastructure-based or wired network.
As wireless communications networks become more prevalent, security continues to be a major concern to both communication network providers and end users. This is most evident when using a mobile wireless network where the security environment can offer the greatest challenges since data may be readily received and manipulated by many nodes. The radio links used in a wireless network expose the signaling and data traversing the network to eavesdroppers and/or would-be hackers. In a multi-hop wireless network, this requires each link in the meshed devices to have a unique security association established through the multi-hop authentication and key management process. Then, the air frames on the link can be protected with the established security associations.
Today's security solutions typically establish a security association between an authentication server and a node joining the network. Unfortunately, it can take ten seconds for the node to complete authentication with an authentication server. When a mobile station associates with an access point, for example, there are techniques available allowing the station to use the key material it establishes during first contact with the network to accelerate future reconnections with other access points in the network. For example, one solution currently being proposed for the IEEE 802.11r standard includes a first contact step with full authentication with an online authentication server and a base mechanism that reuses the key material established during first contact to accelerate the security handshake process. The full authentication establishes a key hierarchy for use in subsequent link establishment, thus supporting fast station transitions between access points.
When a mesh node joins a mesh network and establishes a secure link with one of its mesh neighbors, it is advantageous to provide an accelerated security mechanism enabling secure links between the mesh node and a plurality of other neighboring mesh nodes that are also members of the mesh quickly.
Skilled artisans will appreciate that elements in the figures are illustrated for simplicity and clarity and have not necessarily been drawn to scale. For example, the dimensions of some of the elements in the figures may be exaggerated relative to other elements to help to improve understanding of embodiments of the present invention.